The scope of the duties owed by banks to customers who have been defrauded has recently been considered by the Supreme Court. In Philipp v Barclays Bank UK PLC [2023] UKSC 25 (“Philipp”) the Court considered the scope of the so-called “Quincecare” duties owed by banks and, in particular, clarified the scope of that decision in the context of “authorised push payment” (“APP”) fraud.
In summary, and as explained in detail in the remainder of this note, in Philipp the Supreme Court held that the duties owed by banks to their customers do not extend to APP fraud, whereby the victim is induced by fraudulent means to authorise their bank to send a payment to a bank account controlled by the perpetrator of the fraud. Therefore banks, when given valid instructions by the customer (rather than its agent), do not owe any independent duties to that customer not to execute a valid order.
The remainder of this note is structured as follows:
Quincecare line of authorities;
The decision in Philipp; and

Regulatory context and reform.

Quincecare line of authorities
In Barclays Bank plc v Quincecare Limited (“Quincecare”),[1] the Court held that a bank must not execute it’s a payment instruction given by an agent of its (corporate) customer if there are reasonable grounds for believing that those instructions are an attempt to misappropriate the customer’s funds. A facet of the duty is thus to exercise reasonable skill and care in and about executing the customer’s instructions. A significant feature of Quincecare is that the facts centred on instructions given to the bank by its customer’s dishonest agent (who also happened to be a director of the company).
However, and significantly, Steyn J in handing down the Court’s judgment in Quincecare also acknowledged that this duty is subordinate to the bank’s primary duty, to act on valid instructions from the customer:

“Given that the bank owes a legal duty to exercise reasonable care in and about executing a customer’s order to transfer money, it is nevertheless a duty which must generally speaking be subordinate to the bank’s other conflicting contractual duties.”

The careful balance of differing policy considerations was a key theme of Steyn J’s judgment. On one hand, the judge noted that the law should not impose too burdensome an obligation on bankers, which hampers the effective transacting of banking business unnecessarily while on the other hand she acknowledged that the law should “guard against the facilitation of fraud, and exact a reasonable standard of care in order to combat fraud and to protect bank customers and innocent third parties”. This approach was followed by the Court of Appeal in Philipp, but ultimately (as summarised below) disavowed by the Supreme Court.
Ultimately, Steyn J held that the “sensible compromise” to strike the right balance between these competing policy considerations was that a banker must refrain from exercising an order if and for as long as the banker is ‘put on inquiry’ for believing that the order is an attempt to misappropriate the funds of the company. On the facts of that case, the claim failed because there was nothing to put the bank on inquiry as to the director’s dishonesty.
Later cases considered the scope of the Quincecare duties owed by banks. In particular, Lady Hale, in Singularis Holdings v Daiwa Capital Markets,[2] summarised the Court’s decision in Quincecare in the following terms:

"In Barclays Bank v Quincecare [1992] 4 All ER 363, Steyn J held that it was an implied term of the contract between a bank and its customer that the bank would use reasonable skill and care in and about executing the customer's orders; this was subject to the conflicting duty to execute those orders promptly so as to avoid causing financial loss to the customer; but there would be liability if the bank executed the order knowing it to be dishonestly given, or shut its eyes to the obvious fact of the dishonesty, or acted recklessly in failing to make such inquiries as an honest and reasonable man would make; and the bank should refrain from executing an order if and for so long as it was put on inquiry by having reasonable grounds for believing that the order was an attempt to misappropriate funds." (emphasis added).

By the time the case had reached the Supreme Court in Singularis, the incidence of the Quincecare duty was not in issue. At trial Rose J had held that the bank Daiwa had breached its Quincecare duty on the facts because it had executed transfers of money out of a company's account, which were approved by the individual with authority to give instructions to make such payments, in circumstances in which any reasonable banker would have realised there were many obvious, even glaring, signs that he was perpetrating a fraud on the company.
Following Singularis, the so-called Quincecare duty found new prominence in English case law, having been considered by the lower courts and the Court of Appeal in a number of cases all of which involved a fraud at the relevant corporate customer of the bank, perpetrated by an agent misusing his or her authority to misappropriate the principal’s (the corporate customer’s) funds.[3]
The decision in Philipp
Philipp involved APP fraud whereby the bank’s customer, Mrs Philipp was induced by third party fraudsters, posing as representatives of the National Crime Agency and the Financial Conduct Authority, to make two transfers out of her personal bank account to overseas corporate accounts of £400,000 and £300,000. On each occasion, Mrs Philipp attended a branch of Barclays Bank in person and gave instructions for the international transfers to be made.
When Mrs Philipp discovered that she had been a victim of fraud, she brought a claim against Barclays alleging that it had breached its Quincecare duty by failing to implement policies and procedures to detect and prevent APP fraud.

First instance and Court of Appeal decisions

At first instance,[4] HHJ Russen KC granted summary judgment in the bank’s favour and in so doing, held that the Quincecare duty was confined to cases where there is suspicion of attempted misappropriation of the customer’s funds by their agent.
Mrs Philipp appealed and the Court of Appeal overturned the first instance judge’s decision. While the Court of Appeal confirmed that it was “undeniable” that the factual circumstances of the earlier cases concerned a fraudulent agent, they held that the reasoning was capable of applying with equal force outside of that context. They thus held that, as a matter of law, the Quincecare duty “is a duty on a bank to make inquiries and refrain from acting on a payment instruction in the meantime, [and it] does not depend on the fact that the bank is instructed by an agent of the customer of the bank”. A bank could thus be liable if ‘on inquiry’ that an instruction is an attempt to misappropriate funds, or is vitiated by APP fraud. On the facts of the case, they held that the bank was on inquiry, and had breached its duty owed to Mrs Philipp in carrying out the instruction to transfer funds to the overseas accounts.

The Supreme Court’s decision

The Supreme Court granted permission to appeal and allowed the bank’s appeal, restoring the first instance judge’s order on the Quincecare aspect of the case.[5] The Supreme Court held that the Court of Appeal was wrong to conclude that a bank owes a contractual duty to the customer to protect it from APP fraud, and this was “inconsistent with the first principles of banking law”. In the leading judgment giving by Lord Leggatt, the Court considered: (i) the bank’s primary duty, and (ii) the bank’s duty of care to customers.
With respect to (i), the bank’s primary duty, the Supreme Court found:
- Ordinarily, a bank is not a trustee or fiduciary of money deposited by a customer, but simply a debtor. Money deposited with a bank becomes the bank’s money, to lend or otherwise deal with as it thinks fit. The principal obligation owed by a bank is to discharge its debt owed to the customer when called upon to do so and so the bank is obliged to repay to the customer on demand an equivalent sum to that deposited (subject to agreed interest and/or charges) and (so long as the account is in credit) to make payments in accordance with the customer’s instructions in reduction of its debt to the customer.
- A bank is bound to act in accordance with the authority conferred upon it by its principal and to perform what it has agreed to do (namely, its ‘mandate’). Unless otherwise agreed, the bank’s duty to comply with its mandate is strict, subject to very limited exceptions (for example, the bank cannot be obliged to act unlawfully).
- There is no obligation on a bank to consider the commercial wisdom of the transaction.
With respect to (ii), the bank’s duty of care, the Supreme Court found:
- As with any contract for the supply of services, the bank must carry out its services to the customer with reasonable care and skill.
- The bank’s duty to exercise reasonable care and skill is subordinate to the bank’s duty to carry out a customer’s order to transfer money.
- The duty to exercise reasonable skill and care is directed solely to the effective execution of the order. It cannot therefore provide an independent basis for failing or refusing to execute a valid payment order.
Philipp was therefore not, in the Supreme Court’s judgment, a Quincecare The defining characteristic of the Quincecare duty is that the instruction was given to the bank by an agent acting in fraud of the customer. This was a key tenet of the Quincecare line of authority, and the reasoning of the Court of Appeal in applying the Quincecare reasoning to the facts of Philipp was “flawed at each stage” the flaws “stem[ming] from trying to find a way to reach a sound conclusion starting from a mistaken premise”.
However, and despite the Supreme Court disavowing the analytical approach of balancing policy considerations in order to identify the duties owed by a bank to its customer (as adopted in Quincecare and by the Court of Appeal in Philipp), it held that principles of agency justified the decision in the Quincecare line of authorities described above. In particular, actual authority conferred by the customer on a signatory does not include authority to act dishonestly in fraud of the customer. However, a bank will generally be able to rely on apparent authority of an agent, but not if there are circumstances suggestive of dishonesty apparent to the bank. If the bank is on inquiry, there is a duty to exercise reasonable skill and care to ascertain whether the instruction is actually authorised. These same principles did not apply in Philipp, where the payment instruction was not given by an agent, but by Mrs Philipp directly.

Regulatory context and reform

Payment Services Regulations 2017

The Payment Services Regulations 2017 (the “2017 Regulations”) was introduced in order to give effect to the EU Payment Services Directive (2015/2366). Following Brexit, it was retained with minor modifications.
Part 7 of the 2017 Regulations is principally concerned with unauthorised payment transactions. However, it does not provide for reimbursement of any payments the payer has authorised save in very limited circumstances.

The Financial Services and Markets Act 2023

On 29 June 2023, the Financial Services and Markets Act 2023 (“FSMA 2023”) has received Royal Assent and will come into effect in 2024.
Under Section 72 of FSMA 2023, liability for victims who have been defrauded of their funds will be imposed on banks and payment providers “where the payment order is executed subsequent to fraud or dishonesty”. It also provides that the losses will be allocated equally between the sending and receiving providers.
The scheme applies only to the “Faster Payments Service” (“FPS”). The FPS is a service for sending electronic, sterling payments in the UK. Most major UK banks offer the FPS service. It is confined to customers, charities and “micro-enterprises” and it excludes larger businesses. However, perhaps critically, it is not proposed that obligations under the scheme will be directly enforceable by bank customers, and so it remains to be seen how effective it will be in providing recourse to victims of APP fraud.

[1] [1992] 4 All ER 343.

[2] [2019] UKSC 50.

[3] Nigeria v JP Morgan Chase Bank, NA [2019] 2 CLC 559 (CA) and [2022] EWHC 1447 (Comm); JP SPC v Royal Bank of Scotland International Ltd [2023] AC 461 (PC); and Stanford International Bank v HSBC Bank PLC [2023] AC 761 (SC).

[4] [2021] Bus LR 451.

[5] [2023] 3 WLR 284

Rebecca Coyle, Quinn Emanuel Urquhart & Sullivan

We are Informa Connect

Live events, digital content and training for professionals who want to achieve more.

Choose your interest

Attend

Engage

TMRE: The Market Research Event

Private Placements Industry Forum - PPIF (USA)

CompLaw: Private Enforcement

TP Minds Americas

The Mechanics of Project Finance

Diploma in Ship Superintendency

Certificate in Chartering

Diploma in Marine Surveying

Learn

Watch

Speak

Read

Merck calls on Culmination for de-identified patient data to speed trials

Ichor Clinical partners with CROs in Australia, Ireland and UK

Oncodesign Services buys Dutch CRO ZoBio

Post-Event Report eBook: Finance & Accounting for Bioscience Companies

About Informa Connect

Master P on how hip hop and corporate America can help each other

How to use brand intimacy to your advantage

Meet the fintechs hoping to change the world

How to craft killer headlines